{"id":"MGASA-2026-0535","summary":"Updated jq package fixes security vulnerabilities","details":"Embedded NUL truncates top-level jq programs loaded with -f.\n(CVE-2026-41256)\nSigned-int overflow in `stack_reallocate` (jq VM stack).\n(CVE-2026-41257)\nWild stack write via signed-integer overflow in decNumber D2U() macro.\n(CVE-2026-43894)\nEmbedded NUL in jq import paths causes local redaction-policy bypass and\npreserves sensitive fields in published artifacts. (CVE-2026-43895)\nStack Overflow in Recursive Object Merge. (CVE-2026-43896)\nStack overflow in module loading on mutual `include`. (CVE-2026-44777)\nStack overflow in deep structural equality. (CVE-2026-47770)\njq --rawfile invalid-state reuse after String too long causes\nheap-buffer-overflow. (CVE-2026-49839)\nPotential integer overflow in jvp_string_append. (CVE-2026-54679)\n","modified":"2026-10-23T06:01:08.496490839Z","published":"2026-10-23T05:45:46Z","upstream":["CVE-2026-41256","CVE-2026-41257","CVE-2026-43894","CVE-2026-43895","CVE-2026-43896","CVE-2026-44777","CVE-2026-47770","CVE-2026-49839","CVE-2026-54679"],"references":[{"type":"ADVISORY","url":"https://advisories.mageia.org/MGASA-2026-0535.html"},{"type":"REPORT","url":"https://bugs.mageia.org/show_bug.cgi?id=35785"},{"type":"WEB","url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/R2ZT3O453YX2G4PIOLGAVJX45WHP37RM/"},{"type":"ADVISORY","url":"https://github.com/jqlang/jq/security/advisories/GHSA-cfh2-vwfq-qfmm"},{"type":"ADVISORY","url":"https://github.com/jqlang/jq/security/advisories/GHSA-29gj-222p-j7vx"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2026/07/msg00003.html"},{"type":"ADVISORY","url":"https://github.com/jqlang/jq/security/advisories/GHSA-vf2h-chrj-q3fg"},{"type":"ADVISORY","url":"https://github.com/jqlang/jq/security/advisories/GHSA-4jm8-m363-4539"},{"type":"ADVISORY","url":"https://github.com/jqlang/jq/security/advisories/GHSA-5v7p-2r57-2g4g"},{"type":"ADVISORY","url":"https://github.com/jqlang/jq/security/advisories/GHSA-7q7g-mrq3-phxr"},{"type":"ADVISORY","url":"https://github.com/jqlang/jq/security/advisories/GHSA-mg96-6h3q-g846"},{"type":"ADVISORY","url":"https://github.com/jqlang/jq/security/advisories/GHSA-rmpv-jgvr-wpr9"},{"type":"WEB","url":"https://lists.debian.org/debian-security-announce/2026/msg00327.html"}],"affected":[{"package":{"name":"jq","ecosystem":"Mageia:10","purl":"pkg:rpm/mageia/jq?arch=source&distro=mageia-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.2-1.mga10"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2026-0535.json"}}],"schema_version":"1.9.0","credits":[{"name":"Mageia","contact":["https://wiki.mageia.org/en/Packages_Security_Team"],"type":"COORDINATOR"}]}